Exercises

Ch 1

• Q10. Describe a concrete example where improving the security of a system against one type of attack can increase the likelihood of other attacks.

Creating a central server that encrypts user information on that server. This introduces DoS attacks because the attacker can now target the IP address and prevent requests from being filled.

Ch 2

• Q3. Consider a group of 30 people who wish to establish pair-wise secure communications using symmetric-key cryptography. How many keys need to be exchanged in total.

Each person needs to create a key for each pair, so 29. 29 * 30 = 870. all combination of keys between two people. We are double counting, so divide by 2. 435 keys!

• Q4. Suppose Bob receives a messages signed using a digital signature scheme with Alice’s secret signing key. Does it prove that Alice saw the message and chose to sign.

No, because private keys are stored on computer so maybe some hacker or virus could have executed the signature, without Alice’s approval.

• Q6. Suppose a chosen-ciphertext attacker cannot recover the secret decryption key for an encryption scheme. Does this mean the encryption scheme is secure?

No, because the attacker can collect corresponding plain and cipher text and store them, so if the message is signed by same user with same message again, you can pull the information and know the plaintext, exploiting the system. As the set of plain and cipher text pairs increase, you can also analyze certain patterns that can deduce future ciphertexts

• Q7. Consider a symmetric-key cryptosystem in which cryptographic keys are randomly selected from the set of all n-bit strings. Approximately what should n be in order to provide 128 bits of security against a birthday attack.

$\sqrt{2^n}$ is the size of different values where you expect getting a collision, if we want to provide security with 128 bits against a bday attack, n should be double, or 256 bits. So that the first collision we will expect is when we have 2^128 different values.

General

1. Suppose you read about RSA encryption and wanted to find it’s standard specification. Where would you look?

https://www.rfc-editor.org/rfc/rfc8017. RFC Editor is a website to upload technical specification standards around Internet Engineering Task Force, which is a global nonprofit organization pushing to improve the Internet.